tee_api_arith_mpi.c (62): struct bigint_hdr *hdr = (struct bigint_hdr *)bigInt;
Point where number of bytes to process is defined
tee_api_arith_mpi.c (63): size_t n = mpi->n;  *** Buffer: bigint_hdr hdr + 1[]
tee_api_arith_mpi.c (66): while (n && !mpi->p[n - 1])  *** Loop condition evaluation: (n != 0) (assuming false)  *** Loop condition evaluation: n && !mpi->p[n - 1] (false)  *** Not entering the loop
tee_api_arith_mpi.c (69): if (hdr->alloc_size < n)  *** Condition evaluation: (hdr->alloc_size < n) (false)
tee_api_arith_mpi.c (72): hdr->nblimbs = n;
tee_api_arith_mpi.c (73): hdr->sign = mpi->s;
Point where buffer is passed to the function 
tee_api_arith_mpi.c (74): memcpy(hdr + 1, mpi->p, mpi->n * sizeof(mbedtls_mpi_uint));  *** Buffer: bigint_hdr hdr + 1[]

tee_api_arith_mpi.c (92): COMPILE_TIME_ASSERT(sizeof(mbedtls_mpi_uint) == sizeof(uint32_t));
tee_api_arith_mpi.c (93):   *** Loop condition evaluation: 0 (false)  *** Not entering the loop
tee_api_arith_mpi.c (98): COMPILE_TIME_ASSERT(sizeof(struct bigint_hdr) ==
tee_api_arith_mpi.c (99): sizeof(uint32_t) * BIGINT_HDR_SIZE_IN_U32);  *** Loop condition evaluation: 0 (false)  *** Not entering the loop
tee_api_arith_mpi.c (101): mbedtls_mpi_init_mempool(mpi);
tee_api_arith_mpi.c (103): if (bigInt) {  *** Condition evaluation: (bigInt != 0) (assuming true)
tee_api_arith_mpi.c (104): const struct bigint_hdr *hdr = (struct bigint_hdr *)bigInt;
tee_api_arith_mpi.c (105): const mbedtls_mpi_uint *p = (const mbedtls_mpi_uint *)(hdr + 1);
tee_api_arith_mpi.c (106): size_t n = hdr->nblimbs;
Point where number of bytes to process is defined
tee_api_arith_mpi.c (109): while (n && !p[n - 1])  *** Buffer: mbedtls_mpi_uint mpi->p[]  *** Loop condition evaluation: (n != 0) (assuming false)  *** Loop condition evaluation: n && !p[n - 1] (false)  *** Not entering the loop
tee_api_arith_mpi.c (112): MPI_CHECK(mbedtls_mpi_grow(mpi, n));
tee_api_arith_mpi.c (113): mpi->s = hdr->sign;  *** Loop condition evaluation: 0 (false)  *** Not entering the loop
Point where buffer is passed to the function 
tee_api_arith_mpi.c (114): memcpy(mpi->p, p, n * sizeof(mbedtls_mpi_uint));  *** Buffer: mbedtls_mpi_uint mpi->p[]

ldelf_loader.c (393): uaddr_t usr_stack = uctx->ldelf_stack_ptr;
ldelf_loader.c (394): TEE_Result res = TEE_ERROR_GENERIC;
ldelf_loader.c (395): struct dl_entry_arg *arg = NULL;
ldelf_loader.c (396): uint32_t panic_code = 0;
ldelf_loader.c (397): uint32_t panicked = 0;
ldelf_loader.c (398): size_t len = strnlen(sym, maxlen);
        Point where number of bytes to process is defined
        strnlen.c (75): _CONST char *start = str;  *** Number of bytes to process: str-start == 0  *** Buffer: const char sym[]
        strnlen.c (77): while (n-- > 0 && *str)  *** Loop condition evaluation: (n > 0) (assuming true)  *** Loop condition evaluation: (*str != 0) (assuming false)  *** Loop condition evaluation: n-- > 0 && *str (false)  *** Not entering the loop
        strnlen.c (80): return str - start;
ldelf_loader.c (399): struct ts_session *sess = NULL;  *** Number of bytes to process: len == 0  *** Buffer: const char sym[]
ldelf_loader.c (401): if (len == maxlen)  *** Condition evaluation: (len == maxlen) (false)
ldelf_loader.c (404): usr_stack -= ROUNDUP(sizeof(*arg) + len + 1, STACK_ALIGNMENT);
ldelf_loader.c (405): arg = (struct dl_entry_arg *)usr_stack;
ldelf_loader.c (411): (uaddr_t)arg, sizeof(*arg) + len + 1);
ldelf_loader.c (407): res = vm_check_access_rights(uctx,
ldelf_loader.c (412): if (res) {  *** Condition evaluation: (res != 0) (assuming false)
ldelf_loader.c (417): memset(arg, 0, sizeof(*arg));
ldelf_loader.c (418): arg->cmd = LDELF_DL_ENTRY_DLSYM;
ldelf_loader.c (419): arg->dlsym.uuid = *uuid;
Point where buffer is passed to the function 
ldelf_loader.c (420): memcpy(arg->dlsym.symbol, sym, len);  *** Number of bytes to process: len == 0  *** Buffer: const char sym[]

core_mmu.c (550): size_t n = 0;
core_mmu.c (551): paddr_t pa;
core_mmu.c (552): paddr_size_t size;
core_mmu.c (566): while (true) {  *** Loop condition evaluation: 1 (true)  *** Entering the loop
core_mmu.c (567): if (n >= (num_elems - 1)) {  *** Condition evaluation: (n >= num_elems - 1) (assuming false)
Point where number of bytes to process is defined
core_mmu.c (571): if (n == *last)  *** Buffer: tee_mmap_region memory_map + n + 1[]  *** Condition evaluation: (n == *last) (assuming true)
core_mmu.c (572): break;  *** Exit the loop
core_mmu.c (590): memmove(memory_map + n + 1, memory_map + n,
core_mmu.c (591): sizeof(struct tee_mmap_region) * (*last - n));
Point where buffer is passed to the function 
core_mmu.c (590): memmove(memory_map + n + 1, memory_map + n,  *** Number of bytes to process: 40 * *last - n == 0  *** Buffer: tee_mmap_region memory_map + n + 1[]

core_mmu.c (602): size_t n = 0;
core_mmu.c (605): while (true) {  *** Loop condition evaluation: 1 (true)  *** Entering the loop
core_mmu.c (606): if (n >= (num_elems - 1)) {  *** Condition evaluation: (n >= num_elems - 1) (assuming false)
Point where number of bytes to process is defined
core_mmu.c (610): if (n == *last)  *** Buffer: tee_mmap_region memory_map + n + 1[]  *** Condition evaluation: (n == *last) (assuming true)
core_mmu.c (611): break;  *** Exit the loop
core_mmu.c (617): memmove(memory_map + n + 1, memory_map + n,
core_mmu.c (618): sizeof(struct tee_mmap_region) * (*last - n));
Point where buffer is passed to the function 
core_mmu.c (617): memmove(memory_map + n + 1, memory_map + n,  *** Number of bytes to process: 40 * *last - n == 0  *** Buffer: tee_mmap_region memory_map + n + 1[]

aes-cts.c (97): TEE_Result res = TEE_SUCCESS;
aes-cts.c (98): uint8_t tmp2_block[64] = { 0 };
aes-cts.c (99): uint8_t tmp_block[64] = { 0 };
aes-cts.c (100): int len_last_block = 0;
aes-cts.c (101): int block_size = 16;
aes-cts.c (102): int nb_blocks = 0;
aes-cts.c (104): if (!last_block)  *** Condition evaluation: !last_block (assuming false)
aes-cts.c (109): nb_blocks = (len + block_size - 1) / block_size;
aes-cts.c (110): if (nb_blocks < 2)  *** Condition evaluation: (nb_blocks < 2) (assuming false)
aes-cts.c (112): len_last_block = len % block_size;
aes-cts.c (113): if (len_last_block == 0)  *** Condition evaluation: (len_last_block == 0) (assuming true)
Point where number of bytes to process is defined
aes-cts.c (114): len_last_block = block_size;  *** Number of bytes to process: block_size-len_last_block == 0  *** Buffer: uint8_t tmp_block + len_last_block[-16...47]
aes-cts.c (116): if (mode == TEE_MODE_ENCRYPT) {  *** Condition evaluation: (mode == 0) (assuming true)
aes-cts.c (118): data + ((nb_blocks - 1) * block_size),
aes-cts.c (119): len_last_block);
aes-cts.c (117): memcpy(tmp_block,
        memcpy.c (99): char *dst = dst0;  *** Buffer: uint8_t tmp_block + len_last_block[-16...47]
        memcpy.c (100): _CONST char *src = src0;
        memcpy.c (101): long *aligned_dst;
        memcpy.c (102): _CONST long *aligned_src;
        memcpy.c (106): if (!TOO_SMALL(len0) && !UNALIGNED(src, dst)) {
        memcpy.c (130): while (len0--)  *** Loop condition evaluation: (len0 != 0) (true)  *** Entering the loop
        memcpy.c (131): *dst++ = *src++;
        memcpy.c (130): while (len0--)  *** Loop condition evaluation: (len0 != 0) (assuming false)  *** Not entering the loop
        memcpy.c (133): return dst0;
aes-cts.c (120): memset(tmp_block + len_last_block,
aes-cts.c (122): block_size - len_last_block);
Point where buffer is passed to the function 
aes-cts.c (120): memset(tmp_block + len_last_block,  *** Number of bytes to process: block_size - len_last_block == 0  *** Buffer: uint8_t tmp_block + len_last_block[-16...47]

Point where value is declared
Point where value is declared 
snprintk.c (270): size = 0; /* XXX: shutup gcc */